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The intermediate quantum states of multiple qubits, generated during the operation of Shor's 
factoring algorithm are analyzed. Their entanglement is evaluated using the Groverian measure. It 
is found that the entanglement is generated during the pre-processing stage of the algorithm and 
remains nearly constant during the quantum Fourier transform stage. The entanglement is found to 
be correlated with the speedup achieved by the quantum algorithm compared to classical algorithms. 
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I. INTRODUCTION 



The potential speedup of quantum algorithms is 
demonstrated by Shor's factoring algorithm, which is ex- 
ponentially faster than any known classical algorithm . 
Several other quantum algorithms, which are more effi- 
cient than their classical counterparts were introduced 
0j IE S @ ■ Factorization is of special interest due to its 
role in current methods of cryptography. Although the 
origin of the speed-up offered by quantum algorithms is 
not fully understood, there are indications that quantum 
entanglement plays a crucial role 0,0|- In particular, it 
was shown that quantum algorithms that do not create 
entanglement can be simulated efficiently on a classical 
computer It is therefore of interest to quantify the 
entanglement produced by quantum algorithms and ex- 
amine its correlation with their efficiency. This requires 
to develop entanglement measures for the quantum states 
of multiple qubits that appear in quantum algorithms. 
Recently, the Groverian measure of entanglement was in- 
troduced and used for the evaluation of entanglement in 
certain pure quantum states of multiple qubits jj] . Using 
computer simulations of the evolution of quantum states 
during the operation of a quantum algorithm, one can ob- 
tain the time evolution of the entanglement. Such anal- 
ysis was performed for Grover's search algorithm with 
various initial states and different choices of the marked 
states |Toj| . It was shown that Grover's iterations gener- 
ate highly entangled states in intermediate stages of the 
quantum search process, even if the initial state and the 
target state are product states. 

In this paper we analyze the quantum states that are 
created during the operation of Shor's factoring algo- 
rithm. The entanglement in these states is evaluated us- 
ing the Groverian measure. It is found that the entangle- 
ment is generated during the pre-processing stage. When 
the quantum Fourier transform (QFT) is applied to the 
resulting states, their entanglement remains unchanged. 
This feature is unique to periodic quantum states, such as 
those that result from the pre-processing stage of Shor's 
algorithm. When other states, such as product states or 
random states are fed into the QFT, their entanglement 
does change. Another interesting feature is that the en- 
tanglement is found to be correlated with the speedup 



achieved by the quantum factoring algorithm compared 
to classical algorithms. This means that the cases where 
no entanglement is created are those in which classical 
factoring is efficient. 

The paper is organized as follows. In Sec. [H]we briefly 
review Shor's factoring algorithm, the QFT algorithm, 
and the quantum circuit used to perform it. In Sec. IIIII 
we describe the Groverian entanglement measure and the 
numerical method in which it is calculated. In Sec. HVI we 
use the Groverian measure to evaluate the entanglement 
created by Shor's algorithm. The results are discussed in 
Sec. [Viand summarized in Sec. IVII 



II. SHOR'S FACTORING ALGORITHM 

Shor's algorithm factorizes a given non-prime integer 
N, namely, it finds integers p\ and pi, such that their 
product P1P2 — N. The algorithm consists of three parts: 
(a) Pre-processing stage, in which the quantum register is 
prepared using classical algorithms and quantum paral- 
lelism; (b) Quantum Fourier transform, which is applied 
on the output state of the previous stage; (c) Measure- 
ment of the register and post-processing using classical 
algorithms. 



A. Pre-processing 

Given an integer N to be factorized, choose any integer 
y < N, and find the integer q = 2 L that satisfies 



N 2 <q< 2N 2 



(1) 



Prepare a register of L qubits (later referred to as the 
main register) in the equal superposition state 
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1 9-1 



(2) 



Next, use quantum operations to calculate y a mod N for 
all the indices, a = 0, . . . , q — 1, of the basis states above, 
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The quantum circuit of the QFT is shown in Fig. ^ To 
obtain the transformation in Eq. ©, the L qubits of 
register |o) in the input (and throughout the quantum 
circuit) are indexed by k — 1, . . . , L, from bottom to top. 
The output of the circuit is stored in register |c), whose 
qubits are indexed from top to bottom. We define the 
operator to be the Hadamard gate applied to qubit fc, 
and the operator Bk,m (where m > k) to be a controlled 
phase operator, which applies a phase of 9k, m = ir/2 m ~ k 
only if both qubits k and m are 1. We also define 



FIG. 1: The circuit of the quantum Fourier transform (QFT) 
performed on a 4-qubit register. The operator A is the 
Hadamard gate. The operators B\, B2 and B3 are the 
controlled-phase gates B^.m, where m — k = 1, 2 and 3, re- 
spectively. 

and store the results in an auxiliary register, giving rise 
to the joint state 

1 9-1 

— Y,\o)\v a ^odN). (3) 

This essentially completes the pre-processing stage. How- 
ever, in order to present the next stage of the algorithm 
more clearly, it is helpful to measure the auxiliary regis- 
ter in the computational basis. Suppose that the result 
of the measurement is a state \z), where z = y l (mod N) 
and I is the smallest positive integer that gives the value 
z. The order of y modulus N is defined as an integer r 
that satisfies y r = 1 (mod N). The equality 

y jr+l = y l (mod N) (4) 

is thus satisfied for any integer j. From Eq. J2J it follows 
that the measurement will select from the main register 
all values of a = I, I + r, I + 2r, . . . , I + Ar, where A is the 
largest integer which is smaller than (q— l)/r. The state 
of the register after the measurement is therefore 



F k = A k B k , k+1 Bk,k+2...B k ,L, (8) 

for k = 1, . . . , L, where we follow the standard notation 
for quantum operators, namely, those on the right hand 
side operate first. With these definitions the sequence of 
quantum operations that perform the QFT is given by 

QFT = FiF 2 . . . F L . (9) 

The number of one-qubit and two-qubit gates required in 
the quantum circuit which performs QFT is polynomial 
in the size of the register. 

In the simple case in which r divides q exactly, namely 
A + 1 = q/r, one obtains 

QFT|« = ^gexp(^)|^). (10, 

V j=Q \ / 

where \4>i) is defined in Eq. (JSJ. The resulting state is 
a superposition of all basis states with indices which are 
products of q/r. If r is not a divisor q, namely, q/r is 
not an integer, Eq. (|10|l should be modified such that 
the large amplitude states are those which correspond to 
integers adjacent to jq/r, j = 0, 1, . . . , r — 1. Our choice 
of q in Eq. ensures that with high probability the 
measurement will yield only states whose indices are the 
nearest integers to jq/r. 



3=0 



(5) 



B. Quantum Fourier Transform 

The quantum Fourier transform is given by 

q-l q-1 
a=0 c=0 

where 



(6) 



q-l 



2niac 



/>) = ^Eexp(^ ) ./(„,. 



(7) 



C. Measurement and Post-Processing 

The third part of the algorithm starts with a measure- 
ment of the register. It yields an integer approximation, 
c, of one of the values jq/r, j = 0, 1, . . . , r — 1. Thus, cr 
is approximately an integer multiple of q. Here, again, 
our choice of q in Eq. (JIJ ensures that in most cases there 
exist another integer c 1 which satisfies \rc — c'q\ < r/2. 
As a result 



< 



2q 



(11) 



Using a continued fraction expansion of c/q it is possible 
to efficiently find d and r. There is only one such ap- 
proximation which satisfies Eq. for r < N . Thus, 
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the correct value of r is obtained. If r is even we can 
define x — y r l 2 which satisfies 

x 2 - 1 = (x - 1)0 + 1) = (mod N). (12) 

From Eq. I|12f) we obtain that x + 1 (mod N) and x — 
1 (mod N) are candidates for having a common divisor 
with N. Using Euclid's greatest common divisor (GCD) 
algorithm, this common divisor is found and the factoring 
process is completed. 



III. THE GROVERIAN MEASURE OF 
ENTANGLEMENT 

A. Formal Definition 

Consider a quantum algorithm, given by the unitary 
operator U, applied to the equal superposition state \rf). 
For a certain class of quantum algorithms, the final, or 
target state 

\t) = U\ V ), (13) 

is a computational basis state. This state stores the cor- 
rect result of the calculation, which can be extracted 
by measurement. Not all quantum algorithms can be 
expressed in this form, because the final state, before 
the measurement is done, may be a superposition state. 
However, in the case of Grover's search algorithm with a 
single marked state, this description applies 9]. Consider 
the case in which such algorithm, U, is applied to an arbi- 
trary pure state The probability of success is defined 
as the probability that the measurement will still give the 
state \t). This probability is given by P s = \(t\ip)\ 2 . 

The success probability can be used to evaluate the en- 
tanglement of the state \tp). To this end, before the algo- 
rithm U is applied, one applies a local unitary operator, 
Uk, on each qubit fc = 1,2, ... ,L. These operators are 
chosen such that the success probability of the algorithm 
will be maximized. The maximal success probability is 



where the |efc)'s are single-qubit states. Eq. l(TB|l means 
that for a given initial state the maximal success 
probability of such algorithm, U, is equal to the maximal 
overlap of \ip) with any product state. 

The Groverian measure of entanglement G(ip) is de- 
fined by 



= v 7 ! - iW (17) 

For the case of pure states, for which G(ip) is defined, it is 
closely related to an entanglement measure introduced in 

Refs. pmm 

and was shown to be an entanglement 
monotone. The latter measure is defined for both pure 
and mixed states. It can be interpreted as the distance 
between the given state and the nearest separable state 
and expressed in terms of the fidelity of the two states. 
Based on these results, it was shown 9] that G(ip) sat- 
isfies: (a) G(ip) > 0, with equality only when is a 
product state; (b) G(ip) cannot be increased using local 
operations and classical communication (LOCC). There- 
fore, G(ip) is an entanglement monotone for pure states. 
A related result was obtained in Ref. [l4|, where it was 
shown that the evolution of the quantum state during 
the iteration of Grover's algorithm corresponds to the 
shortest path in Hilbert space using a suitable metric. 

B. Numerical Evaluation 

Consider a pure quantum state of L qubits 

IV>)=X>li>- (is) 

3=0 

In order to find G(ip) we form a convenient representation 
of the tensor product states used in Eq. (|16|) . The state 
of each qubit in the product state is given by 

|e fe ) = e iS " [cos# fc |0) + e** sin0 fe |l)] . (19) 
Let us denote 



Pmax= max \{t\UUi®---<&U L \ 

Ui,...,U L 



(14) 



Using Eq. (fT^|l the success probability P max can be ex- 
pressed by 



P, 



max — 

max |(?7|i7i <8> • • • <8> Ul\^)Y 

Ui,...,Ul 



(15) 



cos 9 k if ju = 
e llk sin6> fc if j k = 1, 



(20) 



where jk, k — l,...,L is the /c'th most significant bit 
in the binary representation of j. The overlap between 
\ip) and the product state |ei ® • ■ • ® e^) is given by 
/(^,6»i, . . . ,0l,7i, . . . ,7l) = (ei (g) • • • (g) e L \ip). It can 
then be written as 



This can be re-written as 



Pmax = max |(ei<g>- 

|ei),...,|ez,) 



(16) 



,7l] 



2 L -1 

E ^ 

3=0 



(21) 
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The phases 6k only introduce a global phase which can 
be ignored. The Groverian entanglement measure for the 
state \ip) is given by 



± max — 



max 



■,JL 



1/(^,6*1, . . . ,0l,7i, . . . ,7l)T 



(22) 

namely, the dimension of the parameter space in which 
the maximization is obtained is 2L. However, the num- 
ber of terms summed up in the calculation of / increases 
exponentially with the number of qubits. Therefore, to 
make the calculation of G(ip) feasible one should min- 
imize the number of evaluations of /. The commonly 
used steepest descent algorithm, requires a large number 
of evaluations of / and is thus computationally ineffi- 
cient. Here we accelerate the calculation by performing 
the maximization analytically and separately for a single 
pair of Ok and 7fc. During each maximization step, all the 
other parameters are held fixed. In the maximization we 
have a function of the form 




10 20 30 40 

Time Steps 



/ = c fe cos k + <4e m sin k 



(23) 



where a k = |cifc | e lQfc and bj = \bj\e il3: > depend on the other 
2L — 2 parameters. The maximization of |/| vs. Ok and 
7fc leads to 



FIG. 2: The Groverian measure of entanglement for states cre- 
ated during the operation of the QFT on three randomly cho- 
sen tensor product states (dashed, dotted and dashed-dotted) 
as well as on a single random state (solid line). All the states 
are of nine qubits. 



Iff 



|c fe | 2 + |4| 2 



(24) 



Entanglement Generated by the QFT 
Procedure 



where 



cos Ok 



vkl 



and 



(25) 



Here we evaluate the time evolution of the Groverian 
entanglement during the QFT process, shown in Fig. ^ 
The Groverian measure is evaluated after each operation 
of the Bk : m operator. The Ak operators are local and 
do not change the entanglement, We first perform this 
analysis for general quantum states and then focus on 
the specific quantum states that appear in the factoring 
algorithm. 



7fc ^ otk — fa- (26) 

Using this method, the number of evaluations of / is sig- 
nificantly reduced. To find the global maximum, P max 
and then G(ip) we perform several rounds of maximiza- 
tion over all the 2L parameters. Trying different ini- 
tial conditions we find that the convergence to the global 
maximum is fast and no other local maxima are detected. 



IV. ENTANGLEMENT DURING SHOR'S 
ALGORITHM 

Shor's factoring algorithm includes a pre-processing 
stage followed by QFT. Here we analyze the quantum 
states generated in each of these stages and evaluate their 
entanglement using the Groverian measure. 



1. QFT Applied on General Quantum States 

To examine the effect of QFT on the Groverian en- 
tanglement we construct an ensemble of random product 
states as well as random states of n qubits. The state 
of each qubit in the random product states is described 
by Eq. (|T§|) where < k < tt and < ~fk < 2tt are 
chosen randomly. The random states are drawn from an 
isotropic distribution in the 2 L -dimensional Hilbert space 
[Icj . These states turn out to be highly entangled. 

In Fig. |21 we present the time evolution of the Grove- 
rian measure during the processing of QFT on three ran- 
dom product states as well as on a random state of nine 
qubits. For the random product states one observes that 
during most time steps the entanglement remains un- 
changed. Most of the variation takes place at specific 
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FIG. 3: The Groverian measure of entanglement for states 
created during the QFT stage of Shor's factoring algorithm. 
The solid line shows the factorization of N = 91 using y = 41. 
The dotted line (with zero entanglement) shows the factor- 
ization of N — 33 using y — 23. The dashed line shows the 
factorization of N = 33 using y — 4. 



times, common to all the different states. Clearly, the 
entanglement is generated by the controlled phase oper- 
ators Bk t m- The large variations in G(?/>) are found to 
take place when \m — k\ is small, namely when Bk t m is 
applied on pairs of adjacent qubits. The Groverian mea- 
sure during the operation of QFT on a highly entangled 
random state is also shown in Fig. [5] It exhibits only 
small variations with no obvious regularity. 



2. QFT Within Shor's Factoring Algorithm 

In Fig. [3] we present the time evolution of the Grove- 
rian measure during QFT, when it is applied on states 
obtained from the pre-processing stage of Shor's factoring 
algorithm. The different lines correspond to the factor- 
ization process of different numbers. Surprisingly, for all 
numbers that we have tested, the entanglement was es- 
sentially unchanged throughout the process, as implied 
by the horizontal lines. This is in contrast to the behav- 
ior observed when QFT is applied to general quantum 
states. 

A special property of the states generated by the pre- 
processing is that they are periodic. This motivated us 
to examine the time evolution of the Groverian measure 
during QFT of general periodic states. The state ^ m |Z + 
mr) (up to normalization factor) is a periodic state of L 
qubits, with period r and shift I. The summation is over 
all integers m such that < l+mr < q— 1, where q — 2 L . 



It was found that the Groverian measure essentially does 
not change during the QFT process of such states, and 
that the changes which do occur vanish exponentially 
with the number of qubits. The value of the Groverian 
measure for these states depends almost solely on the 
odd part of the period r. More precisely, for a periodic 
state with period r — 2 M d (where d is odd), we obtain 
P max ~ 1/d. This is easy to explain for states with a 
period r = 2 M , which are known to be tensor product 
states. For these states d = 1, thus the correct result 
of P max = 1 is obtained. For general periodic states we 
do not have an analytical derivation of the expression for 
p 

1 m ax • 



B. Entanglement in the Pre-processing Stage 

Having found that the QFT stage of Shor's algorithm 
does not alter the entanglement of states created by the 
pre-processing stage, it is clear that all the entanglement 
is produced during pre-processing. We have evaluated 
this entanglement generated during the factoring process 
of all the integers in the range 3 < N < 200. To fac- 
torize an integer, N, one has to choose another integer 
1 < y < N — 1. In our analysis, we examined all pos- 
sible choices within this range, and for each of them we 
applied the pre-processing stage as described in Sec. [H] 
At the end of the pre-processing stage we evaluated the 
Groverian measure of the resulting state of the main reg- 
ister, following a measurement of the auxiliary register. 
In Fig. 0|we present the Groverian measure for the states 
obtained after pre-processing vs. N for 3 < N < 200. 
Each dot represents the Groverian measure after pre- 
processing for the integer N and for a specific choice of 
1 < y < N — 1. The solid line represents the function 
y/1 — 1/(2N). We observe that all the dots are below 
this line, which resembles the upper bound of the Grove- 
rian measure, namely that for any state \ip) of L qubits 
< ^/l~l/2 L . 

Additionally, there are many values of N and choices 
of y for which the Groverian measure is G — 0, namely 
the factoring process does not involve any entanglement. 
For these particular choices, it should thus be possible 
to perform the factoring of N efficiently using a classical 
algorithm |8( . We find that for some of the pairs of N 
and y which produce no entanglement, GCD(A^, y) =/= 1, 
thus a divisor of N can be easily found classically. The 
rest of these pairs are found to satisfy y 2 — 1 mod N, 
for some integer n, which means thatGCD(?/ 2 " +1,N) 
or GCD(y 2 " 1 — l,iV) are divisors of N, which can be 
easily found by classical algorithms. We thus find that in 
cases in which no entanglement is produced by the quan- 
tum algorithm, it offers no speedup compared to classical 
algorithms. This is consistent with the assumption that 
the entanglement generated by a quantum algorithm is 
correlated with the speedup it provides. 
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FIG. 4: The Groverian measure of entanglement for the states 
created by the pre-processing stage of Shor's algorithm. Each 
dot corresponds to a single choice of 2 < N < 200 and 1 < 
y < N- 1. 



V. DISCUSSION 

It is found that the states prepared by the pre- 
processing stage of Shor's algorithm, like all periodic 
states, exhibit the property that their Groverian entan- 
glement does not change throughout the QFT stage. 
One may take the view that the Groverian entanglement 
somehow represents the amount of quantum information 
present in a quantum state. This is rather like the von 
Neumann entropy. Taking this view, our result may seem 
natural because the information needed to perform the 
factoring is already present after the pre-processing stage. 
The QFT only rearranges the information such that it 
can be extracted by measurement. 

It is found that the Groverian measure of the states 
generated by Shor's algorithm is lower than that of ran- 
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